February 2022 Summaries

The growing field of software supply chain security differs from traditional application security in various ways, requiring different tools and techniques. As Gartner predicts a three-fold increase in software supply chain attacks by 2025, it is crucial to understand the differences between these two types of security. In this blog post, we contrasted software supply chain security against application security in the context of the DevOps process. We identified various risks associated with both application and software supply chain security at different stages of the development process, such as planning, coding, building, and protecting. Managing down the risk of software supply chain attacks requires security activities at many places in the DevOps process, and the industry is maturing to address these challenges.

The study analyzed how top 250 starred open-source projects on GitHub protect their source code, focusing on metrics like Pull Requests (PRs), repo interactions, and quality outcomes. Branch Protection and CODEOWNERS were found to positively impact PR review quality. The research also highlighted the need for better security of software supply chains, CI/CD pipelines, and DevOps toolchains. Key findings include that repositories with more contributors tend to use Branch Protection policies, while usage of CODEOWNERS settings is currently low. Additionally, enabling Branch Protection generally increased PR Review Quality Score, while introducing the CODEOWNERS setting had a mixed impact on mean TBI and interactions. The study suggests opportunities for dynamic approaches to code protection that can improve DevOps processes and enhance code quality.